# 02. DENY for all DPPs in 'us-east' except backend with v2
type: MeshTrafficPermission
mesh: mesh-1
name: mtp-1
spec:
  targetRef:
    kind: MeshServiceSubset
    name: web
    tags:
      version: v1
  from:
    - targetRef:
        kind: MeshServiceSubset
        name: backend
        tags:
          kuma.io/zone: us-east
          version: v2
      default:
        action: Allow
---
type: MeshTrafficPermission
mesh: mesh-1
name: mtp-2
spec:
  targetRef:
    kind: Mesh
  from:
    - targetRef:
        kind: MeshSubset
        tags:
          kuma.io/zone: us-east
      default:
        action: Deny
